Executive brief
merge-deep is a popular JavaScript library used to recursively merge objects in Node.js applications. Versions before 3.0.1 allow attackers to pollute the JavaScript prototype chain, potentially causing arbitrary code execution or application crashes by modifying core object behaviors across the entire application.
Technical details
The vulnerability is a prototype pollution flaw (CWE-471) in the merge function of merge-deep before version 3.0.1. The vulnerable code fails to filter the __proto__ property when merging objects, allowing an attacker to inject properties into the Object prototype. The attack requires no authentication and is triggered by passing a malicious object to the merge function—any application that merges untrusted data is at risk. An attacker can pollute the prototype to override built-in object methods and properties, leading to denial of service or remote code execution depending on the application logic. The fix, released in version 3.0.1, explicitly blocks the __proto__ key from being merged.
Affected products
- merge-deep merge-deep before 3.0.1
Timeline
- 2018-07-26: disclosed
- 2018: patched: version 3.0.1 released